1. Introduction

1. 1. Introduction

2. Topics • What is Forensic Science? • What is Digital Forensics? • Uses of Digital Forensics • Role in the Judicial System

3. What is Digital Forensics?

4. Digital Evidence • Computers record evidence of everything you do, and also • Cell phones • ATM machines • Web servers • Email servers • SMS systems • etc.

5. Slow to Change • Attorneys and judges often know little about digital evidence • Digital forensic scientists must therefore be teachers as well as technical experts

6. Forensic Science • Forensics • Application of science to solve a legal problem • Digital Forensics • Application of computer science and investigative procedures • Analysis of digital evidence • Search authority • Chain of custody • Validation with mathematics • Use of validated tools • Repeatability • Reporting • Expert presentation

7. Items to Examine • Laptop and desktop computers • Mobile devices • Networks • Cloud systems • Video, audio, and images • Authenticity, comparison, enhancement

8. Uses of Digital Forensics • Criminal investigations • Child pornography • Identity theft • Homocide, sexual assault, robbery, burglary… • Almost every criminal investigation • Civil litigation • Intelligence • Administrative matters

9. Forensics Backlog • "…there were massive backlogs within all police forces, to the point where it was six months to two years before some computers could be examined" • Link Ch 1a on my Web page • samsclass.info • "CNIT 121"

10. Law Enforcement Paradigm • Police need to think of and seek out digital evidence • Seize • Cell phones • Gaming consoles • Cameras • Etc.

11. Bind. Torture. Kill. • Dennis Rader • Respected citizen • Also a serial killer • Murdered ten people in Kansas from 1974 to 1991 • He confessed in an anonymous letter to a newspaper • He offered to send police a floppy disk • Police said it couldn't be traced

12. Metadata • Metadata on the RTF file he sent contained • Dates • Title: "Christ Lutheran Church" • "Last Saved By:" Dennis • Christ Lutheran Church Wichita website showed Dennis Rader as President of Congregation Council

13. John Mcaffee • Fugitive from Belize police • Posed for a photo in Guatemala • Published on the Internet with GPS location metadata • Link Ch 1c

15. Civil Litigation • eDiscovery is a $780 million business • Hiring in San Francisco now • eDiscovery definition • "any process in which electronic data is sought, located, secured, and searched with the intent of using it as evidence in a civil or criminal legel case" • Both parties are entitled to examine evidence • This process is called "Discovery"

16. Google's Billion Dollar eDiscovery Error • This email was marked "Confidential" on some copies but not on others • Accidentally revealed as evidence • Link Ch 1d • (Google didn't actually lose the $1 billion)

17. Intelligence • Terrorists and foreign governments use digital tools and the Internet • US Military uses documents and media in the DOCEX and DOMEX processes

18. DOMEX • DOCEX (Document Exploitation) • "Procedures used by the United States Armed Forces to discover, categorize, and use documents seized in combat operations" • "Documents" includes digital media • DOMEX (Document and Media Exploitation) • Use of documents by various agencies after collection • Link Ch 1f

20. Real Aid to the Enemy • "…a real-world example from 2007. When a new fleet of helicopters arrived … in Iraq, some Soldiers took pictures... From the photos that were uploaded to the Internet, the enemy was able to determine the exact location of the helicopters inside the compound and conduct a mortar attack, destroying four of the AH-64 Apaches." • Link Ch 1d

21. Administrative Matters • Digital evidence is used to detect policy violations • Accessing forbidden websites at work • SEC Office of the Inspector General • Firewall logs showed officials surfed porn at work • Link Ch 1f

22. Locard's Exchange Principle • When perps enter or leave a crime scene, they will leave something behind or take something with them • Such as DNA, fingerprints, hair, fibers, etc. • Also true of digital forensics • Registry keys, log files, etc.

23. Scientific Method • Forensic science is new and procedures are still being developed • A scientist is normally regarded as objective, neutral, dealing only with facts • BUT forensic experts are hired by both prosecution and defense, and state expert opinions as well as facts

24. Organizations of Note

25. "brings together organizations actively engaged in the field of digital and multimedia evidence to foster communication and cooperation as well as to ensure quality and consistency within the forensic community" • Link Ch 1h

26. Premier forensic organization in the world • Develops standards of practice • 6000 members, including directors of most federal crime labs • Link Ch 1i

27. American Society of Crime Laboratory Directors/Laboratory Accreditation Board (ASCLD/LAB) • ASCD/LAB accredited labs are the "gold standard" in forensics • They set standards and requirements for accreditation • Link Ch 1j

28. NIST(National Institute of Standards and Technology) • National Software Reference Library • Known file signatures for operating system software and other items of no investigative value • Computer Forensic Tool Testing • Link Ch 1l

29. Also develops standards for forensics • Link Ch 1k

30. HTCIA(not in textbook) • High-Tech CrimeInvestigation Association • Organization of peace officers, investigators, prosecuting attorneys, and security professionals • But NOT criminal defense experts • Link Ch 1g

31. Defense Lawyers • Understand their goals • Hurting the expert & freeing the client is a win for them • Image from http://www.zazzle.com/lawyer_shark_trust_me_bumper_sticker-128101885100809676

32. Role of the Forensic Examiner in the Judicial System • Expert witness • Qualified to render an opinion • Must be effective communicators • Must be teachers • Must be without bias • Follow the evidence wherever it leads